K8s部署gitlab/gitlab-ce

Kubernetes部署GitLab服务
#------------------------定义代理服务-------------------------
apiVersion: v1
kind: Service
metadata:
  name: gitlab
spec:
  type: NodePort
  ports:
  # Port上的映射端口
  - port: 443
    targetPort: 443
    name: gitlab443
  - port: 80
    targetPort: 80
    name: gitlab80
  - port: 22
    targetPort: 22
    name: gitlab22
  selector:
    app: gitlab
---

# ------------------------定义Gitlab的部署 -----------------------

apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
  name: gitlab
spec:
  selector:
    matchLabels:
      app: gitlab
  revisionHistoryLimit: 2
  template:
    metadata:
      labels:
        app: gitlab
    spec:
      con
root@k8s-m001:~/devops/test-devops/gitlab# ll total 44 drwxr-xr-x 3 root root 4096 Jun 15 18:25 ./ drwxr-xr-x 7 root root 4096 Jun 15 18:21 ../ -rw-r--r-- 1 root root 1337 Jun 15 18:21 gitlab-deployment.yaml -rw-r--r-- 1 root root 520 Jun 15 18:22 gitlab-ingress.yaml -rw-r--r-- 1 root root 723 Jun 15 17:51 gitlab-nfs-pvc-pro.yaml -rw-r--r-- 1 root root 58 Jun 14 21:55 gitlab-ns.yaml -rw-r--r-- 1 root root 293 Jun 15 18:25 gitlab-services.yaml drwxrwxrwx 2 root root 4096 Jun 15 16:31 gitlab.wh02.com_nginx/ -rw-r--r-- 1 root root 9078 Jun 15 16:28 gitlab.wh02.com_nginx.zip root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: gitlab namespace: gitlab spec: selector: matchLabels: app: gitlab replicas: 1 template: metadata: labels: app: gitlab spec: securityContext: fsGroup: 1000 containers: - name: gitlab image: harbor.wh02.com/cicd/gitlab/gitlab-ce:17.11.0-ce.0 imagePullPolicy: Always ports: - containerPort: 80 - containerPort: 22 env: - name: GITLAB_OMNIBUS_CONFIG value: | external_url 'https://gitlab.wh02.com' gitlab_rails['initial_root_password'] = "Aa123123" gitlab_rails['gitlab_default_locale'] = 'zh_CN' gitlab_rails['gitlab_default_locale_in_system'] = true volumeMounts: - name: gitlab-storage mountPath: /var/opt/gitlab subPath: data - name: gitlab-storage mountPath: /var/log/gitlab subPath: logs - name: gitlab-storage mountPath: /etc/gitlab subPath: config resources: requests: cpu: "2" memory: "5Gi" limits: cpu: "2" memory: "6Gi" volumes: - name: gitlab-storage persistentVolumeClaim: claimName: gitlab-pvc root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: gitlab-ingress namespace: gitlab annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: ingressClassName: nginx tls: - hosts: - gitlab.wh02.com secretName: gitlab-tls rules: - host: gitlab.wh02.com http: paths: - path: / pathType: Prefix backend: service: name: gitlab-service port: number: 80 root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-nfs-pvc-pro.yaml apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: nfs-gitlab-static provisioner: kubernetes.io/no-provisioner volumeBindingMode: WaitForFirstConsumer reclaimPolicy: Retain --- apiVersion: v1 kind: PersistentVolume metadata: name: gitlab-pv spec: capacity: storage: 50Gi accessModes: - ReadWriteMany nfs: server: 192.168.3.101 path: /data/k8sdata/gitlab_data storageClassName: nfs-gitlab-static persistentVolumeReclaimPolicy: Retain --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: gitlab-pvc namespace: gitlab spec: accessModes: - ReadWriteMany resources: requests: storage: 50Gi storageClassName: nfs-gitlab-static volumeName: gitlab-pv root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-ns.yaml apiVersion: v1 kind: Namespace metadata: name: gitlab root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-services.yaml apiVersion: v1 kind: Service metadata: name: gitlab-service namespace: gitlab spec: selector: app: gitlab type: NodePort ports: - name: http port: 80 targetPort: 80 # nodePort: 30030 - name: ssh port: 22 targetPort: 22 # nodePort: 30022 root@k8s-m001:~/devops/test-devops/gitlab# kubectl get secrets -n gitlab No resources found in gitlab namespace. root@k8s-m001:~/devops/test-devops/gitlab# kubectl get secrets -A NAMESPACE NAME TYPE DATA AGE ingress-nginx ingress-nginx-admission Opaque 3 97m jenkins harbor-pull-secret kubernetes.io/dockerconfigjson 1 7h41m kube-system calico-etcd-secrets Opaque 3 40h kubernetes-dashboard dashboard-admin-user kubernetes.io/service-account-token 3 65d kubernetes-dashboard kubernetes-dashboard-certs Opaque 0 65d kubernetes-dashboard kubernetes-dashboard-csrf Opaque 1 65d kubernetes-dashboard kubernetes-dashboard-key-holder Opaque 2 65d kuboard kuboard-admin-token kubernetes.io/service-account-token 3 40h kuboard kuboard-viewer-token kubernetes.io/service-account-token 3 40h root@k8s-m001:~/devops/test-devops/gitlab# kubectl get pv,pvc -n gitlab NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE persistentvolume/gitlab-pv 50Gi RWX Retain Bound gitlab/gitlab-pvc nfs-gitlab-static <unset> 44m persistentvolume/jenkins-pv 10Gi RWX Retain Released jenkins/jenkins-pvc <unset> 26h persistentvolume/pvc-1464be8d-5bc8-4ba1-8d91-c282167ea4cf 50Gi RWX Delete Bound jenkins/jenkins-pvc nfs-dynamic <unset> 7h41m persistentvolume/pvc-49a9790f-7ebf-43a6-8454-b90cf50d2f3d 50Gi RWX Retain Released jenkins/jenkins-pvc nfs-dynamic <unset> 7h54m persistentvolume/pvc-4ddd9d5b-a734-4889-af64-0c96f340ce11 50Gi RWX Retain Released jenkins/jenkins-pvc nfs-dynamic <unset> 8h NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE persistentvolumeclaim/gitlab-pvc Bound gitlab-pv 50Gi RWX nfs-gitlab-static <unset> 44m 我想知道到底怎么配置,让ingress访问到gitlab的域名 https://gitlab.wh02.com 证书已经生成过 root@k8s-m001:~/devops/test-devops/gitlab/gitlab.wh02.com_nginx# kubectl create secret tls gitlab-tls --cert=tls.crt --key=tls.key -n gitlab secret/gitlab-tls created
06-16
<think>我们正在配置KubernetesIngress以通过HTTPS域名访问GitLab实例。用户已经生成了证书并创建了名为gitlab-tls的Secret。现在需要正确配置Ingress规则。步骤:1.确保已经部署GitLab实例(例如通过Helm或直接部署)。2.创建TLSSecret(用户已经完成:kubectlcreatesecrettlsgitlab-tls--cert=path/to/cert.crt--key=path/to/cert.key)。3.配置Ingress资源,指定主机名为gitlab.wh02.com,并关联TLSSecret。示例Ingress配置(YAML):```yamlapiVersion:networking.k8s.io/v1kind:Ingressmetadata:name:gitlab-ingressnamespace:gitlab#如果GitLab部署gitlab命名空间spec:tls:-hosts:-gitlab.wh02.comsecretName:gitlab-tls#引用已创建的Secretrules:-host:gitlab.wh02.comhttp:paths:-path:/pathType:Prefixbackend:service:name:gitlab-webservice#根据实际部署Service名称填写port:number:80#通常GitLabWeb服务端口是80(HTTP)或443(HTTPS),但Ingress会处理TLS终止,所以这里指向服务的HTTP端口```注意:-确保域名gitlab.wh02.com的DNS解析指向IngressController的IP地址。-如果使用IngressController(如NginxIngressController),需要确保它已经部署。验证:访问https://gitlab.wh02.com,应该能打开GitLab页面。问题排查:1.检查IngressController的日志,确保Ingress配置已加载。2.使用`kubectldescribeingressgitlab-ingress-ngitlab`查看Ingress状态。3.检查证书是否有效(例如使用`openssls_client-connectgitlab.wh02.com:443`)。补充:如果GitLab部署时使用了其他服务(如SSH),可能需要额外配置Ingress规则,但通常Web访问只需要上述配置。用户可能还需要在GitLab配置中设置外部URL,以便GitLab生成正确的链接。这通常在部署GitLab时通过环境变量`external_url`设置,例如:external_url:"https://gitlab.wh02.com"因此,在部署GitLab的配置中(如Helmvalues.yaml)应设置:global:hosts:https:trueingress:configureCertmanager:false#如果使用自己的证书,可以禁用cert-managergitlab:webservice:ingress:tls:secretName:gitlab-tls#或者通过Ingress配置,这里根据部署方式而定但是,如果用户已经部署GitLab,可能需要检查并更新外部URL配置。由于用户问题集中在Ingress配置,我们主要提供Ingress资源的配置示例。相关问题:1.如何为KubernetesIngress生成自签名证书?2.如何配置Ingress以同时支持HTTP和HTTPS?3.如何更新Ingress中的TLS证书?</think>要配置 Kubernetes Ingress 通过 HTTPS 访问 GitLab 实例(`https://gitlab.wh02.com`),需完成以下步骤: --- ### 1. **验证证书和 Secret 准备** - 确保证书有效且包含域名 `gitlab.wh02.com`: ```bash openssl x509 -in cert.crt -text -noout | grep "DNS" # 输出应包含:DNS:gitlab.wh02.com ``` - 确认 Secret 已正确创建: ```bash kubectl get secret gitlab-tls -o yaml # 检查 tls.crt 和 tls.key 字段是否存在 ``` --- ### 2. **配置 Ingress 资源** 创建 Ingress YAML 文件(`gitlab-ingress.yaml`): ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: gitlab-ingress namespace: gitlab-ns # 替换为 GitLab 的命名空间 annotations: # 若使用 Nginx Ingress Controller kubernetes.io/ingress.class: "nginx" nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # GitLab 默认使用 HTTPS spec: tls: - hosts: - gitlab.wh02.com secretName: gitlab-tls # 引用已创建的 Secret rules: - host: gitlab.wh02.com http: paths: - path: / pathType: Prefix backend: service: name: gitlab-webservice # GitLab Web 服务名称 port: number: 443 # GitLab 服务端口(通常为 443) ``` --- ### 3. **部署并验证** - 应用配置: ```bash kubectl apply -f gitlab-ingress.yaml ``` - 检查 Ingress 状态: ```bash kubectl get ingress -n gitlab-ns # 查看 ADDRESS 字段是否为 Ingress Controller 的 IP ``` - 测试访问: ```bash curl -I https://gitlab.wh02.com # 应返回 HTTP 200 ``` --- ### 4. **关键注意事项** 1. **DNS 解析** 确保域名 `gitlab.wh02.com` 解析到 Ingress Controller 的 IP(可通过 `kubectl get svc -n ingress-nginx` 查看 EXTERNAL-IP)。 2. **GitLab 配置** 在 GitLab 的 `gitlab.rb` 中设置外部 URL: ```ruby external_url "https://gitlab.wh02.com" ``` 3. **防火墙** 开放 Ingress Controller 的 443 端口(如 AWS Security Group、云防火墙规则)。 --- ### 常见问题排查 - **证书错误**: 检查 Secret 中的证书是否完整:`kubectl describe secret gitlab-tls`。 - **404 错误**: 确认 GitLab Service 名称和端口正确(默认为 `gitlab-webservice:443`)。 - **502 错误**: 检查 GitLab Pod 是否就绪:`kubectl get pods -n gitlab-ns`。 > 引用[^1]: Kubernetes 证书管理实践,[Kubernetes kubeadm 证书到期,更新证书](https://kaisawind.gitee.io/2020/12/04/2020-12-04-k8s-kubelet) --- ### 相关问题 1. 如何为 Kubernetes Ingress 生成自签名证书? 2. 如何配置 HTTP 到 HTTPS 的自动重定向? 3. 如何扩展 Ingress 以支持 GitLab 的 SSH 访问(端口 22)? 4. 如何通过 Cert-Manager 自动续期 TLS 证书?
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值